Medibank Data Breach 2022:
What You Need to Know
Approximately 9.7 million Medibank, ahm, and international student customer records were exposed after attackers used stolen VPN credentials to access internal systems. Here is what happened, what data was leaked (including sensitive health claims), and steps you can take to protect yourself.
Your personal risk from this breach
Sign in or create a free account to see your personalised risk score.
What Happened
How the Medibank Breach Unfolded
August 2022
Credentials belonging to a third-party IT services provider employee were stolen using an infostealer malware variant. These credentials granted access to Medibank's internal systems via a VPN that did not require multi-factor authentication.
13 October 2022
Medibank detected unusual activity on its network and immediately engaged cybersecurity specialists. The attackers had already exfiltrated data over the preceding weeks.
7 November 2022
After weeks of investigation, Medibank confirmed the full scope: 9.7 million current and former customers across Medibank, ahm, and international student policies were affected. Medibank announced it would not pay the ransom demand (reported at US$10 million).
9 November 2022
The attackers began publishing stolen data on the dark web, initially releasing a so-called “good list” and “naughty list” that included sensitive health claims data. Further data dumps continued over the following weeks.
Sources: ABC News (Dec 2022), ABC News (Oct 2022)
What Was Exposed
Personal Data Leaked in the Breach
The breach affected 9.7 million current and former customers across Medibank, ahm, and international student policies. For approximately 480,000 customers, sensitive health claims data was also exposed, including diagnoses, procedures, and provider details.
| Data Type | Risk Level | Who Was Affected |
|---|---|---|
| Full name | High | All approximately 9.7 million affected customers |
| Date of birth | High | All approximately 9.7 million affected customers |
| Email address | High | All approximately 9.7 million affected customers |
| Phone number | High | All approximately 9.7 million affected customers |
| Home address | High | All approximately 9.7 million affected customers |
| Medicare number | High | Subset of affected customers |
| Passport number | High | Subset of affected customers (including international students) |
| Health claims data | High | Approximately 480,000 customers (diagnoses, procedures, provider details, sensitive conditions) |
Risk levels based on the Australian Government's PSPF and OAIC Australian Privacy Principles. Health claims data is rated at the highest level due to its sensitivity and the impossibility of changing medical history.
Confirmed NOT Exposed
Medibank confirmed that no credit card or banking details were included in the breached dataset. Driver licence numbers were also not part of the exposed data for most customers.
Company Response
What Medibank Did
“Based on the extensive advice we have received from cybercrime experts, we believe there is only a limited chance paying a ransom would ensure the return of our customers' data and prevent it from being published.”
Actions Taken by Medibank
- Immediately isolated affected systems and engaged cybersecurity specialists
- Notified the Australian Federal Police (AFP), OAIC, and Australian Cyber Security Centre (ACSC)
- Refused to pay the US$10 million ransom demand
- Offered affected customers access to Medibank's Cyber Response Support Program (mental health support, identity protection, and financial hardline)
- Provided free identity monitoring through IDCARE
- Established a dedicated response website and support line
What Now?
Steps You Can Take After the Medibank Breach
This breach is particularly sensitive because it included health claims data for hundreds of thousands of customers, alongside name email date of birth phone number and home address for the broader group. Unlike a password or credit card number, health data cannot be changed or reissued, making ongoing vigilance especially important. Here are general best-practice steps, organised by the types of accounts most commonly affected.
Medibank and Health Accounts
Your health insurer account details were exposed. Other health provider accounts may share the same email.
Secure your Medibank account
~5 minReview other health provider accounts
Email and Digital Identity
Your email is the key to your digital identity. Securing it is a sensible first step.
Strengthen email security
~5 minUnderstand your full account exposure
Identity and Health Data Protection
Medicare numbers, passport numbers, and health claims data carry long-term identity and privacy risks.
Consider a credit ban (especially if your Medicare or passport number was exposed)
~20 minContact Services Australia about Medicare number misuse
~15 minRecognise the ongoing nature of health data exposure
Monitoring and Reporting
Australian resources for breach response and identity protection.
Stay alert for targeted phishing (including health-related scams)
Not sure which of your accounts are affected?
In The Event Of discovers your accounts automatically and alerts you in real time when new breaches affect your data.
Are You Still at Risk?
The Hidden Danger: Compound Breach Exposure
The Medibank breach did not happen in isolation. If your data also appeared in other major Australian breaches, the combination of leaked information can build a more complete identity profile.
How breach data compounds
On its own, the Medibank breach exposed names, dates of birth, addresses, and (for a subset) health claims data and Medicare numbers. But if your email also appeared in the Optus or Latitude Financial breaches, the combined data set may include driver licence numbers, passport details, and financial information. This kind of compound exposure significantly increases the risk of identity fraud.
- Optus (2022)9.8M records - passport, licence, Medicare numbers
- Medibank (2022)9.7M records - health claims, Medicare details
- Latitude Financial (2023)14M records - driver's licence, passport numbers
- Qantas (2025)5.7M records - name, date of birth, phone, email
If your email appears in two or more of these breaches, your risk level is significantly elevated. In The Event Of can overlay your breach data to show exactly where your exposure compounds, and help you prioritise what to address first.
Frequently Asked Questions
Medibank Breach FAQ
Sources
- The Guardian: "Medibank hackers announce 'case closed' as they dump more stolen data on dark web" (Dec 2022)
- ABC News: "Medibank data breach: what we know" (Oct 2022)
- OAIC: Notifiable Data Breaches Report
- Australian Government Home Affairs: Cyber sanctions
- Australian Government: Protective Security Policy Framework (PSPF)
- OAIC: Australian Privacy Principles
Other Major Australian Data Breaches
Data from multiple breaches can be combined to increase identity fraud risk. Review these guides to understand your full exposure.
Disclaimer: This guide is provided for general informational purposes only and does not constitute legal, financial, or professional advice. The information is based on publicly available sources at the time of writing and may not reflect the most current developments. In The Event Of Pty Ltd (ABN 38 687 352 647) is not affiliated with Medibank Private Limited. If you believe you have been affected by this data breach, we recommend contacting the relevant authorities and seeking professional guidance specific to your circumstances.